Quantum Cryptography Approaching the Classical Limit 
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We consider the security of continuous-variable quantum cryptography as we approach the classical-limit, 
i.e., when the unknown preparation noise at the sender's station becomes significantly noisy or thermal (even 
by as much as 10 4 times greater than the variance of the vacuum mode). We show that, provided the channel 
transmission losses do not exceed 50%, the security of quantum cryptography is not dependent on the channel 
transmission, and is therefore, incredibly robust against significant amounts of excess preparation noise. We 
extend these results to consider for the first time quantum cryptography at wavelengths considerably longer than 
optical and find that regions of security still exist all the way down to the microwave. 

PACS numbers: 03.67.-a, 03.67.Dd, 03.67.Hk, 42.50. -p, 89.70.Cf 



Introduction - Quantum key distribution (QKD) using con- 
tinuous variables (CV) |l|, |2[] allows two people, Alice and 
Bob, to generate a secure key which can be used to encrypt 
messages. CV-QKD protocols using Gaussian modulation [3- 
8], initially begin with Alice preparing a number of randomly 
displaced pure coherent states and sending them over an in- 
secure quantum channel to Bob. Generally, it is assumed that 
Alice's states must be pure quantum states to a good approx- 
imation otherwise her ability to perform QKD will rapidly 
become compromised. This seemed to be borne out by re- 
cent calculations [9] that showed that the distance over which 
CV-QKD was secure, when Alice used mixed coherent states 
in the protocol, fell rapidly as the states became significantly 
impure. 

In this Letter, we show that, provided the channel trans- 
mission losses do not exceed 50 %, the security of quantum 
cryptography is not dependent on the channel transmission, 
and is therefore incredibly robust against significant levels of 
impurity of Alice's states, without the additional previous re- 
quirement of purifiers |9J|. This is a remarkable result as we 
might naturally expect that as Alice's states become more and 
more thermalized secure transmission over any finite distance 
would become impossible. This further motivates an investi- 
gation of the security of CV-QKD as we move from optical 
frequencies into the infrared and down into the microwave re- 
gion. As the wavelength gets longer there is no direct way of 
detecting single photons II 1 Ofl thus ruling out discrete variable 
approaches. While CV measurements still apply, state prepa- 
ration and the quantum channel become thermalized by the 
significant levels of background radiation that exist for longer 
wavelengths at room temperature. Here we show that CV- 
QKD remains, in principle, possible over short distances, well 
into the infrared and into the microwave regime. This surpris- 
ing result highlights the possibility of short-range quantum 
cryptography applications at sub-optical frequencies. 

Quantum Cryptography using Gaussian States - Typical 
Gaussian modulated CV-QKD protocols, begin with Alice 
randomly modulating a vacuum state to create a coherent 



state \a) iflUl . This random modulation or displacement 
a = Qa + iPa contains two independent variables X$ <E 
{Qa, Pa} chosen from a two-dimensional Gaussian distribu- 
tion with variance Vs and zero mean. It is these continuous 
variables that will ultimately be used to construct a secret key 
between Alice and Bob. Alice then sends a whole ensemble 
of these randomly displaced pure coherent states to Bob over 
a quantum channel which is monitored by the eavesdropper, 
Eve. At the output of the channel, Bob measures the incoming 
states using either homodyne J3] or heterodyne detection J^t]. 

The initial modes prepared by Alice can be described in 
the Heisenberg picture as Xa = X$ + X$ where X$ de- 
scribes the classical signal and Xq the thermal mode. Here 
the quadratures Q and P are defined as: Xa <E {Qa,Pa} 
and Xq € {Qo,Pq}- The overall variance V := V(Xa) of 
Alice's initially prepared mode is given by: V = Vs + Vq. 
We can further decompose the variance of the thermal mode 
Vq ■= ^(-^o) into the variance of the pure vacuum mode 
(which is normalized to 1) and the variance of the unknown 
preparation noise at Alice's station /3 to give: Vq — 1+/3. Typ- 
ically, in CV-QKD protocols, we simply have V — Vs+1, i.e., 
zero preparation noise ((3 — 0). In this paper, we consider the 
effect of having non-zero preparation noise on Alice's mode 
preparation, i.e., f3 > 0. We assume that this preparation noise 
cannot be controlled or manipulated by Eve. 

In the analysis of CV-QKD protocols, the collective Gaus- 
sian attacks B12I41411 are the most important. In fact, up to 
a suitable symmetrization of the protocols lfl5ll . these attacks 
bound the most powerful eavesdropping strategy allowed by 
quantum mechanics [ 15]. The most general form of a collec- 
tive Gaussian attack is explicitly described in Ref. fH. This 
consists in Eve interacting her (independent) ancilla modes 
with Alice and Bob's mode for each run of the protocol in such 
a way to generate a memoryless (one-mode) Gaussian chan- 
nel. Eve's ancillas are then collected in a quantum memory 
whose measurement is optimized on Alice and Bob's classical 
communications 1 14]. For a practical implementation of the 
protocols, the most important collective Gaussian attack is the 
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one based on the entangling cloner [16] which is exactly the 
model considered in our paper. This consists in Eve perfectly 
replacing the quantum channel between Alice and Bob with 
her own quantum channel where the loss is simulated by a 
beamsplitter with transmission T (which ranges in value from 
to 1). She then creates her ancilla modes which are two- 
mode squeezed states 111 ill (or commonly known as, Einstein- 
Podolsky-Rosen (EPR) states), with variance W. The modes 
of the EPR beam can be described by the operators E" and 
E. She keeps one mode of the beam E" and injects the other 
mode E into the unused port of the beamsplitter, resulting in 
the output mode E'. Eve then collectively detects all modes 
E' and E", gathered from each of the runs of the protocol, in 
a final coherent measurement. The final stages of the proto- 
col consists in Alice and Bob publicly revealing a subset of 
their data in order to estimate the channel transmission T and 
excess channel noise W |2J]. We also assume that Alice and 
Bob (and Eve) know the variance of the unknown prepara- 
tion noise /3 in order to properly estimate the channel noise as 
opposed to the sum of the channel noise and the preparation 
noise. However, the shot to shot displacement due to the ex- 
cess preparation noise remains unknown to everyone. In the 
final steps of the protocol, Alice and Bob perform a reconcil- 
iation protocol (e.g., see HI) to correct any errors they might 
have between them and then finally privacy amplification [2] 
to reduce Eve's knowledge of the key to a negligible, and safe 
amount. 




0.94 0.96 
Channel Transmission T 

FIG. 1 : Secret key rate R* versus channel transmission T using re- 
verse reconciliation. Increasing the amount of unknown classical 
noise on Alice's preparation modes in CV-QKD. Here the thermal 
radiation is increased: Vo = 1, 
W = 1 (lossy channel), Vs - 
mode. 



10, 1CT, l(r from left to right, where 
= 10 and Vo = 1 is a pure vacuum 



Reverse Reconciliation - We begin our analysis by first us- 
ing the CV-QKD protocol known as reverse reconciliation [4] 
which consists in Alice (and Eve) optimally estimating Bob's 
measurement outcomes. We note that the previous analysis 
given in [9] also considered thermal state CV-QKD using re- 
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FIG. 2: Secret key rate R* versus channel transmission T using di- 
rect reconciliation. Increasing the amount of unknown classical noise 
on Alice's preparation modes in CV-QKD. Here the thermal radiation 
is increased: Vo = 1, 10, 10 2 , 10 3 , 10 4 from top to bottom, where 
W = 1, Vs = 10 5 . We find that direct reconciliation does not show 
any deterioration in channel loss when excessively large amounts of 
preparation noise is added. 



verse reconciliation. However, for completeness, we give the 
derivation for reverse reconciliation which will be helpful in 
calculating the direct reconciliation case and for a compari- 
son between the two protocols. The secret key rate R* for 
reverse reconciliation where Bob uses homodyne detection 
is given by R* := I{X A : X B ) - I{X B : E). Here 
I(Xa ■ Xb) is called the mutual information between Al- 
ice and Bob and defined in terms of the Shannon (or classical) 
entropy 11711 . The quantum mutual information between Eve 
and Bob I(Xb ■ E) is given by the Holevo information 111 811 
and describes the most amount of information one can extract 
from a quantum state. 

The secret key rate R* can be calculated (see Appendix for 
complete derivation) for various values of preparation noise, 
i.e., Vo = 1, 10, 100, 1000. The results are plotted in Fig.Q] 
for a lossy channel (i.e., W = 1 which corresponds to Eve 
simply inserting a vacuum state into the unused port of the 
beamsplitter). We see that, as expected, the security is de- 
pendent on the channel transmission, and starts deteriorating 
rapidly as the excess preparation noise is increased. In fact, af- 
ter only a modest increase in preparation noise (from Vq = 1 
to Vq = 10), the secure region has shrunk to T «> 0.89. 

Direct Reconciliation - We now turn our attention to an- 
other CV-QKD scheme known as direct reconciliation J3]. 
Direct reconciliation, was the first protocol to show that one 
could use Gaussian modulated coherent states to create a se- 
cure key. Unlike, reverse reconciliation, this protocol is a 
forward-way scheme where Bob (and Eve) are trying to op- 
timally estimate the values of Alice's initial displacements, or 
encodings, Qa and Pa- However, direct reconciliation has 
the drawback in its inability to create a secret key when the 
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loss is greater than 3 dB. This corresponds to T < 0.5 and 
can be intuitively thought of as Eve sharing more common in- 
formation with Alice than Bob does. Consequently, reverse 
reconciliation (or post-selection |7|1) is usually considered the 
most practical CV-QKD protocol 11911 . However, as we will 
see, despite these shortcomings, direct reconciliation offers a 
surprising advantage as a potential platform for noise tolerant 
short-range QKD. 

The secret key rate for direct reconciliation using ho- 
modyne detection is defined as := I(Xa ■ Xb) — I(Xa ■ 
E) where I(Xa ■ E) is again the Holevo quantity but now 
defined between Eve and Alice. We can now calculate the 
subsequent key rates (see Appendix for details). In Fig.|2]we 
have plotted the resulting secret key rates for various values 
of Vo using W = 1 and Vs — 10 5 - We find that direct recon- 
ciliation has the amazing feature that as the preparation noise 
becomes more and more significant (even up to 10 4 times that 
of the variance of the pure vacuum mode) only the secret key 
rate decreases and not the channel transmission. So for any 
value of preparation noise the initial starting point is always 
T = 0.5 (c.f. reverse reconciliation where modest increases 
in noise reduce the secure region close to unity transmission, 
i.e., see Fig. [TJ. The basic physics is that, for T > 0.5, the 
presence of quantum noise always gives Alice and Bob a di- 
rect information advantage over Eve. Increased preparation 
noise reduces this advantage, but it always remains finite. In 
contrast, for reverse reconciliation, Alice's ability to estimate 
what Bob received is rapidly compromised by the preparation 
noise. This removes their information advantage over Eve. 

In Fig. |3] we have a security threshold plot for direct and 
reverse reconciliation for W = 1. The solid (blue) curve is 
the previous best bound derived using reverse reconciliation 
and is given by [[91]: ft < (1 — T) -1 . On the same plot we 
have the new direct reconciliation bound which shows a sub- 
stantial improvement over the previous reverse reconciliation 
bound. Remarkably, we can see how direct reconciliation is 
unaffected by the channel transmission once T > 0.5 and is 
secure for a minimum of 4 orders of magnitude of preparation 
noise. Therefore, it is best to use reverse reconciliation when 
T < 0.5 and direct reconciliation when T > 0.5. Addition- 
ally, this result is robust to the addition of small amounts of 
excess noise on the quantum channel (i.e., W > 1) which 
moves the transmission limit slightly over 50% but retains 
qualitatively the same behavior as the lossy case [20]. 

Infrared to Microwave Quantum Cryptography - It is inter- 
esting to consider a possible application of our results: wire- 
less CV-QKD at infrared to microwave frequencies. Today, 
a large number of popular wireless communication technolo- 
gies rely on such frequencies to distribute information. Due 
to the ubiquitous nature of such devices, their security is of 
fundamental importance. Moving to frequencies lower than 
optical rules out discrete variable QKD because of the lack 
of photon counting capabilities. The problem for CV-QKD 
is that operating at lower frequencies at room temperature in- 
evitably introduces a significant amount of thermal noise. In 
contrast to the previous section, we now consider a simplified 
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FIG. 3: Tolerable preparation (classical) excess noise /3 = Vo — 1 
versus channel transmission T for direct and reverse reconciliation 
over a lossy channel. The area under the solid (blue) curve indicates 
the previous best secure region threshold using reverse reconcilia- 
tion @]. However, for direct reconciliation, after T = 0.5, one can 
immediately obtain many orders of magnitude improvement in the 
security threshold. 




15 0.55 0.6 0.65 0.7 0.75 08 0.85 0.9 0.95 1 
Transmission T 

FIG. 4: Security of quantum cryptography over various electro- 
magnetic wave frequencies (at room temperature) as a function of 
channel transmission. Moving our way from the infrared spectrum 
(430 THz) and into the microwave spectrum (300 GHz). Our results 
show that direct reconciliation should be used when channel losses 
are less than 50% and reverse reconciliation otherwise. We note that 
at each point the same impurity applies to both Alice and Eve with 
V S = 10 8 . 



wireless communication protocol where both Alice's prepa- 
ration modes and the quantum channel (Eve) are affected by 
the thermal background. When considering Eve we assume 
that she prepares her attack within a cryostat which allows 
her to essentially prepare pure modes away from the effect of 
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the background radiation. Then to cover her tracks she adds 
known excess noise to her pure states to emulate the thermal 
noise of the environment. 

In the previous section we showed that direct reconciliation 
is significantly more robust against preparation noise than re- 
verse reconciliation and is consequently better suited to our 
current analysis. Given that, the next step is to calculate 
how strong the thermal modes are at particular frequencies 
from optical down to the microwave (1 GHz (A = 30 cm) 
to 300 GHz (A = 1 mm)). To do this we first write the 
average photon number n in terms of the quadrature vari- 
ance V using fi = (ala) = (V - l)/2 =► V = 2n + 1 
where we have symmetrized both quadratures, i.e., V :— 
V(Q) — V(P) and the annihilation operator a is defined 
as a = (Q + iP)/2. Secondly, the average photon number 
is equal to n = [exp(ftw/fcsT) — ll ill and represents 
the blackbody radiation spectrum. For example, at room tem- 
perature T — 300 K and using a microwave frequency of 
w = 1 GHz we find that the variance of the thermal mode 
is V = 7.85 x 10 4 ; while at the other end of the microwave 
spectrum (uj = 300 GHz) the variance is V = 2.63 x 10 2 . 

Using the analysis from the previous section, we can calcu- 
late the secret key rates using direct reconciliation. In Fig. 0] 
we plot the security of CV-QKD from the optical frequency 
(1550 nm) into the infrared region and down into the mi- 
crowave frequency as a function of channel line transmission. 
We point out that the secure region corresponds to R > 0. 
We find a window of security for CV-QKD throughout all of 
the infrared region and into the microwave frequency albeit 
with smaller allowed levels of loss. In the mid-infrared re- 
gion transmission of T « 0.8 is required whilst in the case 
of the microwave region we see that a secure key can only be 
generated when the transmission is higher than T ss 0.9969. 
Nonetheless, it is interesting that a small security window, in 
principle, exists. Future analysis will look at improving the 
region where infrared and microwave CV-QKD is secure. For 
example, in [6] they showed that the security thresholds for 
direct reconciliation could be improved (and in fact beat the 
3 dB loss limit) if two-way quantum communication was used. 
Furthermore, post-selection [7] could also be used to investi- 
gate a possible way to combat the high preparation noise. 

Conclusion - In conclusion, we have shown that when con- 
sidering unknown preparation noise in continuous-variable 
QKD, direct reconciliation is significantly more robust than 
reverse reconciliation when the channel loss does not exceed 
50%. Incredibly, direct reconciliation showed no deterioration 
in the loss threshold, only in secret key rates, even when the 
variance of the thermal noise is as much as 10 4 times greater 
than that of the pure vacuum mode. Furthermore, we have 
shown that infrared to microwave quantum cryptography is, 
in principle, possible over short distances when using con- 
tinuous variables and opens up the possibility of further av- 
enues of investigations. In conclusion, we have shown that 
when considering unknown preparation noise in continuous- 
variable QKD, direct reconciliation is significantly more ro- 
bust than reverse reconciliation when the channel loss does not 



exceed 50%. Incredibly, direct reconciliation showed no de- 
terioration in the loss threshold, only in secret key rates, even 
when the variance of the thermal noise is as much as 10 4 times 
greater than that of the pure vacuum mode. Furthermore, we 
have shown that infrared to microwave quantum cryptogra- 
phy is, in principle, possible over short distances when using 
continuous variables and opens up the possibility of further 
avenues of investigations. 
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APPENDIX 
Introduction to Gaussian Formalisms 

Here we introduce some of the Gaussian tools and tech- 
niques required for our analysis. Such Gaussian formalisms 
can be found elsewhere in the literature typically in the con- 
text of quantum information using continuous variables (for 



example, see 1161. 12 1142311 ). However, in what follows, we give 
the reader a self-contained treatment for what is needed to un- 
derstand and derive the results given in the main text of the 
paper. 

To begin with, we can define the quadrature row vector Y, 
which describes a bosonic system 12411 of n modes, as: 



Y — (Ql, Pit ■••! Qn: Pn)i 



(1) 



where Y\ is the Zth element of the vector. This satisfies the 
commutator relation: 



[Y h Y ni 



2iQ 



lm i 



(2) 



for 1 < I, m, < 2n. Here the matrix O defines the symplectic 
form and is given as 



e 

fc=i 



1 

-1 



(3) 



where f2; m denote the row I and column m of the matrix, e.g., 
fin is the first row and first column entry of ft. Firstly, the 
notation for the above matrix can be explained with a simple 
example. For n = 2 mode case the direct sum (J) means that 
we form two 2x2 block diagonal matrices to create a larger 
4x4 matrix, i.e., 




1 


\ 


-1 






1 




-1 o) 



(4) 
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where the empty spaces indicate zero elements. Secondly, the 
compact version of the commutator given in Eq. (0 can now 
be understood using the simple case of one mode (n = 1) 
where 



71=1 




(5) 



and Y\ :— Q\ and Y<x := Pi for I, m = 1, 2. Therefore Eq. (J2J 
is a compact way of saying the following: 

[Fi,Yi] = [Q x ,Qi] = 2ifi u = 0, 

[r 1 ,y 2 ] = [Q 1 ,p 2 ] = 2zn 12 = 2i, 

[*2,Vi] = - 2ifl 21 = -2i, (6) 

[y 2 ,y 2 ] = [p 2 ,P2] = 2io 22 = o. 

A Gaussian bosonic state p is fully characterized by its dis- 
placement 



Tr(Yp). 



(7) 



and its correlation matrix (CM). The various elements of a 
correlation matrix V can be calculated using the following for- 
mulas. Firstly, the off-diagonal terms: 

V lm := ~<Y,F m + Y m Yi) - (Yi){Y m ), (8) 



and the diagonal elements: 

V U = (Y 2 ) - fr) 2 := V(Yt). 



(9) 



Qualitatively it means that the diagonal terms contain the vari- 
ances whilst the off-diagonal terms contain the correlations. 
An example might help here. A simple vacuum state, where 
the variance of the quadratures is normalized to one, has a CM 
given by 



(10) 



We can see that the variance of each quadrature is on the diag- 
onal, whilst on the off-diagonal we have the zero correlation 
(meaning they are independent) terms. 




The von Neumann entropy 112511 

S(p) = -Tr(plog 2 p), 



(ID 



of a Gaussian state p can be written in terms of its symplectic 
eigenvalues Vk as [26] 



S( P ) 



E 

fc=i 



(12) 



where 



9M : = (i^M^) - (^M^i) 



■v+l 



v - \- 



'v- \- 



(13) 



These symplectic eigenvalues can be calculated using the for- 
mula 



v = \iSW\, 



(14) 



where v > 1. The above notation means that you first find 
the eigenvalues of the matrix ittV and then take the absolute 
values. As it turns out these eigenvalues (known also as the 
symplectic spectrum) are a powerful tool which allows one to 
determine many important features of a Gaussian system. Al- 
though Eq. (fT4l gives one a way of calculating the spectrum, 
the output from using such a formula can sometimes lead very 
complicated equations. In certain circumstances, we are able 
to simplify the calculation of the eigenvalues. Let's look at 
that now. First, consider a generic two-mode CM in block 
form 



V = 




(15) 



It is known that its symplectic eigenvalues v\ and vi can 
be written in the form 



= J ^(A ± VA 2 - 4det V) , (16) 

where det V means the determinant of the matrix V and 

A := dct A + dot B + 2 det C. (17) 
In particular, let us consider a CM of the form 

al VTcZ \ 



V = i - 

y VTcZ bl 

where c > 0, T € [0, 1] and 



(18) 













z = 











(19) 

We can easily verify that dctV = (ab — c 2 T) 2 and A = 
a 2 + b 2 — 2c 2 T. As a consequence, the eigenvalues take the 
simple expression 

i/i, 2 :=i(Vy±(a-b)) , (20) 
where y := (a + b) 2 - 4c 2 T > 4. 

Reverse Reconciliation 

The secret key rate R* for reverse reconciliation where Bob 
uses homodyne detection is given by 



R+ :=I(X A :X B )-I{X B :E), 



(21) 



where I(Xa ■ Xb) is known as the mutual information be- 
tween Alice and Bob and I(Xb ■ E) the mutual information 
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between Bob and Eve. We have a secure key when the key 
rate is positive, i.e., 



R>0. 



(22) 



Another way to think about this is a secure key can be synthe- 
sized when Eve has less information than Alice and Bob: 



I(X A :X B )> I{X b : E). 



(23) 



We also note that, for Alice and Bob, the variable X corre- 
sponds to either of the two quadratures {Q, P}, such that 



X A = {Q A ,P A }, 
X b = {Qb,Pb}- 



(24) 
(25) 



Firstly, let us calculate the mutual information between Alice 
and Bob where 



I(X A : X B ) := H{X B ) - H(X B \X A ). 



Here 



(26) 



(27) 



H(X B ) = ^\og 2 V{X B ), 
is the Shannon (or classical) entropy and 

H(X B \X A ) = hog 2 V(X B \X A ), (28) 

is known as the conditional Shannon entropy Il7tl . To deter- 
mine X B we set up a generic quantum channel with trans- 
mission T £ [0, 1] with excess noise N and model it using a 
beamsplitter equation, where the transmitted output (received 
by Bob) is given by: 

X B = VTX A + Vl - TN. (29) 

The variance of the above equation is given by 

V(Q B ) = V(P B ) = (l-T)W + TV:=b v , (30) 

where both quadratures have been symmetrized and V(N) := 
W . Also, the variance of Alice's modes is given by 



V = Vs + V , 



(31) 



where Vs is the variance of the initial signal encodings and 
Vb is the variance of the vacuum state (see main text for more 
detail). In Eq. d28l the conditional variance term V(X B \X A ) 
is derived by setting up an optimal estimator equation (e.g., 
see its use in |@] or 1281): 



V(X B \X A ) = V(X B ) 



\(XbXs)1 
V(X s ) 



(32) 



where specifically here we have X$ € {Q A , P A } (the signal) 
rather than X A (signal plus noise) because it is Bob's estimate 



of Alice's signal not his estimate of both the signal and noise. 
Calculating this explicitly we get: 

V{Q B \Q A ) = V{P B \P A ) = (1 - T)W + TV := b x . 

(33) 

Using Eq. d26b with Eqs. d27l i and d28l ) we calculate Alice and 
Bob's mutual information to be 



I{X A : X B ) 



1 



log 2 



(1 - T)W + TVs + TV 



(1 - T)W + TVo 



(34) 



We now turn our attention to calculating the mutual infor- 
mation between Eve and Bob. This is given by the Holevo 
information 11811 defined as 



I(X B : E) := S(E) - S(E\X B ). 



(35) 



In the literature it is also common to use the notation \ for the 
Holevo (information) bound (for more background on both 
the classical and quantum information formulas, see e.g., 125, 



29fl). 



Here the quantum entropies S(E) := S(pe) and S(E\X B ) 
are found by calculating the eigenvalues, or symplectic spec- 
trum v, of their corresponding CMs: V^; and V e\x b ^ respec- 
tively. Eve's CM is made up from the two modes E 1 and E" 
(see main text for details) and is given by 



Ve(V,V) 



A[e v ,e v ] ipZ 
ipZ WI 



where 



ev ~ (1 — T)V + TW, 



(36) 



(37) 



and the notation A[-, ■] simply means a diagonal matrix with 
the arguments [-, ■] on the diagonal entries and also 

tp = [T{W 2 - 1)] 1/2 . (38) 

Eve's symplectic spectra can be determined by using Eq. ( f20b 



1, 



4T(W 2 

Eve's conditional CM is given by 



l)±(e v -W)}. (39) 



*e\x b = v 
where Vb is defined in Eq 

n := 




(40) 



(41) 



Furthermore, C is a 4 x 2 matrix describing the quantum cor- 
relations between Eve's modes {E',E"} and Bob's output 
mode X B and is defined as 



(E'X B )l 
(E"X B )Z 




(42) 
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where 



and 



£ = y/T(l-T)(V s + V - W), 



= VT^VW 2 - 1, 



and we have used 



X B = VTX a + Vl^TE, 



and 



E' = y/l - TXi 



TE. 



(43) 



(44) 



(45) 



(46) 



where I(X A ■ Xb) has already been calculated in Eq. ( f34b . 
For Eve, we have 



I(X A : E) := S(E) - S(E\X A ), 



(52) 



where again we have already calculated S(E) previously and 
S(E\X A ) is calculated from the spectrum of the conditional 
CM Ve\x a - Eve's conditional CM for homodyne detection 
using direct reconciliation is equal to 



V B | Qa =\e(V ,V), 



(53) 



where is defined in Eq. ( f36b . Using Eq. ( TT4T > the corre- 
sponding symplectic spectra ve\x a i s: 



Using the above we find that Eve's conditional CM V e\x e 
has the form 



v e \x a = ^=(>J\F±VG\ 



(54) 



' E\X B 




where 



vw 







j± = T(V-W) + W 

\ (1-T)V + TW 

( l-T+TWV n \ 

I W ' 



(47) 



(48) 



where 



F = VV a + T{2 + (T — 2)VV ) - TW{T - 1)(V + V ) 
+ W 2 {T-1) 2 , (55) 

and 

G = (T - 1) 2 {T 2 (V - W) 2 (V - W) 2 + (-V V + W 2 ) 2 



+ 2T(V - W)(W - V )(-2 + VVa + W 2 )). 



(56) 



^ ^T(W 2 - 1) 



v 



TV+W-TW 







The final secret key rate R*~ can now be calculated numeri- 
cally, using Eq. ( BTT l with the appropriate formulas, for various 
values of preparation noise. 



Using Eq. (IT~6b the corresponding symplectic spectra v E \x B 
of Ve\x b can t> e calculated where 



A 



W + V 2 W - AT 2 (V - W){W 2 - 1) 

- T{2V + (V 2 - 3)W - AVW 2 + 4W 3 )} /[T(V - W) + W] , 

(49) 

and 

detV £ | XB = [(— T + (T - 1)VW)(-4(T - \)TW{W 2 - 1) 
+ V(-l + 4(T - l)T(iy 2 - 1))1 /[T(V -W) + W]. 

(50) 

The final secret key rate R* can now be calculated numeri- 
cally, using Eq. (f2TT > with the appropriate formulas, for various 
values of preparation noise. 

Direct Reconciliation 

The secret key rate R* for direct reconciliation using ho- 
modyne detection is given by 



R+ :=I(X A :X B )-I(X A :E), 



(51) 
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